創建新的namespace和sa

[root@k8s-master2 ~]# kubectl create namespace test
namespace "test" created
[root@k8s-master2 ~]# kubectl create sa test -n test
serviceaccount "test" created
[root@k8s-master2 ~]# kubectl get namespace
NAME? ? ? ? ? STATUS? ? AGE
default? ? ?? Active? ? 21d
kube-public?? Active? ? 21d
kube-system?? Active? ? 21d
monitoring? ? Active? ? 7d
test? ? ? ? ? Active? ? 20s
[root@k8s-master2 ~]# kubectl get sa
NAME? ? ? SECRETS?? AGE
default?? 1? ? ? ?? 21d
[root@k8s-master2 ~]# kubectl get sa -n test
NAME? ? ? SECRETS?? AGE
default?? 1? ? ? ?? 30s
test? ? ? 1? ? ? ?? 15s
[root@k8s-master2 ~]#
 

檢查sa的信息

[root@k8s-master2 ~]# kubectl get sa test -n test -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
? creationTimestamp: 2018-09-19T07:01:03Z
? name: test
? namespace: test
? resourceVersion: "439278"
? selfLink: /api/v1/namespaces/test/serviceaccounts/test
? uid: c5aab127-bbd9-11e8-a6ee-000c29bd652e
secrets:
- name: test-token-2drbf
[root@k8s-master2 ~]#
 

見下，ca和token在創建sa時，默認就已經定義

[root@k8s-master2 ~]# kubectl get secret test-token-2drbf -n test
NAME? ? ? ? ? ? ?? TYPE? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? DATA? ? ? AGE
test-token-2drbf?? kubernetes.io/service-account-token?? 3? ? ? ?? 1m
[root@k8s-master2 ~]# kubectl get secret test-token-2drbf -n test -o yaml
apiVersion: v1
data:
? ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURzRENDQXBpZ0F3SUJBZ0lVTWRteDZ0WktZbmh6d1NweVJsa3d1bUlyMys0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNRMDR4Q3pBSkJnTlZCQWdUQWxOYU1Rc3dDUVlEVlFRSEV3SlRXakVNTUFvRwpBMVVFQ2hNRGF6aHpNUkl3RUFZRFZRUUxFd2swVUdGeVlXUnBaMjB4RXpBUkJnTlZCQU1UQ210MVltVnlibVYwClpYTXdIaGNOTVRnd09ESTRNRFl6TXpBd1doY05Nak13T0RJM01EWXpNekF3V2pCZU1Rc3dDUVlEVlFRR0V3SkQKVGpFTE1Ba0dBMVVFQ0JNQ1Uxb3hDekFKQmdOVkJBY1RBbE5hTVF3d0NnWURWUVFLRXdOck9ITXhFakFRQmdOVgpCQXNUQ1RSUVlYSmhaR2xuYlRFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbGN6Q0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKa2UxV05VSCthUUJvV1NLWXVmSmNHWnExWDNwWXZHaytJazBLS08Kb3FZK1BJRFRvdWxTU215RkViOXJRS0prZ2lWeDBzbEZUT3R6ZGswZm03RVVzQU84aE9uQzdyNmwrYWtBOVZmaQpNK0EveXY0SVpRb1BuVHViaWVFRDZZaVhjc0NUSGFNVWtxektkUCtzbGxoQ3EwNVFNYnl1MmJDSGI5MjRrMXZVCjhTMWFvMlFJdUVpSWlSK2U1ejNrRFBGeXBuSm52bnR6UWNWVmd2MkxHYVFpd1BKak4veW8rUHJTNmN2aVEzMmIKUFJsVDc3b2RUZmpETTRsRjltTGlZQ3Z6em1pczhBUFJXSm1rNXJLbjl1NUEwQ2pUUy9yc0Y0dXFwaUIvcDNFaQpuRm5tcjhuQW1OZVFyYmdDMWhqTGdPR0tnWUs3QzhMZExmUHFDN2tLSkx5L3VjRUNBd0VBQWFObU1HUXdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQkFmOENBUUl3SFFZRFZSME9CQllFRkl4SGVqWFoKMGtkbDR1UDJETmhlQ2YrZEFtUjlNQjhHQTFVZEl3UVlNQmFBRkl4SGVqWFowa2RsNHVQMkROaGVDZitkQW1SOQpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFpU3lNUEx3TUJFYXFqOXRzZUlMZU9Zczh4UGZOSHBRREdjOEZLCmc1eTJPaUlXUlV4SXZVRVFhbEMzR1BLc1JBdWM5YlhPdG9KWXZqVEtjYzloQU1sQTdzNU9LZEVvNFR4emREVkcKYmdlTFhyaHJmbzZXZ3ZWL1Nab1pOejJwRUE5OFRhWlNiVjB4MVFIZmUzMEJjdXdKSWJNVW4vd0NEZE9QeVJQMApDN2kzMW9VQTA5Z2tKZ2lSTEthK1h5RU5BUXI1QXp4ZlhvVDZ0UllreFdLKzhUOWJZOEcxMGswbU5MQktIbmp3ClZaZzZzSmo3bHU3eTR4SDdOdTUycTdsSlV2STdtcjFEUFU5T2hzL2tJRTNYWlNJaDJmRU03eUNkVVhsMlVBMkIKWnc2Uit0dy9wL1FZZTM5VTVhSENZV1NnTWpjTHBHTXkrb1I0M3VRV0kxS2YyVGVUCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
? namespace: dGVzdA==
? token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZXlKcGMzTWlPaUpyZFdKbGNtNWxkR1Z6TDNObGNuWnBZMlZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSjBaWE4wSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXpaV055WlhRdWJtRnRaU0k2SW5SbGMzUXRkRzlyWlc0dE1tUnlZbVlpTENKcmRXSmxjbTVsZEdWekxtbHZMM05sY25acFkyVmhZMk52ZFc1MEwzTmxjblpwWTJVdFlXTmpiM1Z1ZEM1dVlXMWxJam9pZEdWemRDSXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMblZwWkNJNkltTTFZV0ZpTVRJM0xXSmlaRGt0TVRGbE9DMWhObVZsTFRBd01HTXlPV0prTmpVeVpTSXNJbk4xWWlJNkluTjVjM1JsYlRwelpYSjJhV05sWVdOamIzVnVkRHAwWlhOME9uUmxjM1FpZlEuZE1yN1FmYUZVZ2RpenIyYktabG9RZTBYRlI2SkJNcGt0VU1mYzZ4T0QzS0JkU3I1R0lOem1OYWNfZzVXa3pReHM5c3l2UHlYSUxaNUl6TlprSlNjdFUtc3pwemplR1FRS2RrLWxRYnpGU0pmY0hWM0NBNURERVFUSzY2QWI4WVVkdXZyZWM5R2lyX29qWVUta0xoNU1MRlhDVjFCcmFuOGIyV0VuOHpuMHBwTUNHWmhrTG81SUhfNlUtajVLTW9TWUNRTGxkbW0wV3hqRFpsVVY0N2p6TGdoQUotSncxaGRWYzdpb2o1cWRMNzhsdEJVb3R1TVU1bkQweF9paDhQVzRsWWxHUlNxQWRmc2QzcVNQMktUTTFFaGg5NkFRa3NQdzdrMVB0aGFYeUFlT1NaSEdJdG45T2lLeF8zSDJLY19wT1dmTi1EMVdOOGJPdnFRUW10NnZB
kind: Secret
metadata:
? annotations:
? ? kubernetes.io/service-account.name: test
? ? kubernetes.io/service-account.uid: c5aab127-bbd9-11e8-a6ee-000c29bd652e
? creationTimestamp: 2018-09-19T07:01:03Z
? name: test-token-2drbf
? namespace: test
? resourceVersion: "439277"
? selfLink: /api/v1/namespaces/test/secrets/test-token-2drbf
? uid: c5c45a22-bbd9-11e8-bc4d-000c29424904
type: kubernetes.io/service-account-token
[root@k8s-master2 ~]#
 

配置新建sa的clusterrole和clusterbinding

[root@k8s-master2 ~]# cat test1clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
? labels:
? ? kubernetes.io/bootstrapping: rbac-defaults
? ? addonmanager.kubernetes.io/mode: Reconcile
? name: test:test
rules:
- apiGroups:
? - ""
? resources:
? - endpoints
? - services
? - pods
? - namespaces
? verbs:
? - list
? - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
? annotations:
? ? rbac.authorization.kubernetes.io/autoupdate: "true"
? labels:
? ? kubernetes.io/bootstrapping: rbac-defaults
? ? addonmanager.kubernetes.io/mode: EnsureExists
? name: test:test
roleRef:
? apiGroup: rbac.authorization.k8s.io
? kind: ClusterRole
? name: test:test
subjects:
- kind: ServiceAccount
? name: test
? namespace: test

用新建sa跑pod

[root@k8s-master2 ~]# cat test1.yaml
kind: Service
apiVersion: v1
metadata:
? name: t1
? namespace: test
spec:
? selector:
? ? app: t1
? ports:
? - protocol: TCP
? ? port: 80
? type: ClusterIP

---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
? name: t1
? namespace: test
spec:
? replicas: 3
? selector:
? ? matchLabels:
? ? ? app: t1
? template:
? ? metadata:
? ? ? labels:
? ? ? ? app: t1
? ? ? ? name: t1
? ? spec:
? ? ? serviceAccountName: test
? ? ? containers:
? ? ? - image: httpd
? ? ? ? name: t1
[root@k8s-master2 ~]#

[root@k8s-master2 ~]# kubectl apply -f test1.yaml
service "t1" created
deployment.apps "t1" created

起來了

[root@k8s-master2 ~]# kubectl get pod,svc -n test
NAME? ? ? ? ? ? ? ? ? ? ? READY? ? STATUS? ? RESTARTS? AGE
pod/t1-6b8bc99585-bcc76? 1/1? ? ? Running? 0? ? ? ? ? 1m
pod/t1-6b8bc99585-nvvbc? 1/1? ? ? Running? 0? ? ? ? ? 1m
pod/t1-6b8bc99585-z2ft9? 1/1? ? ? Running? 0? ? ? ? ? 1m

NAME? ? ? ? TYPE? ? ? ? CLUSTER-IP? ? ? EXTERNAL-IP? PORT(S)? AGE
service/t1? ClusterIP? 10.254.156.160? <none>? ? ? ? 80/TCP? ? 1m
[root@k8s-master2 ~]#

檢查下pod裏用的sa
見下，可以看到使用了我們新建的sa test。

[root@k8s-master2 ~]# kubectl get pod t1-6b8bc99585-z2ft9 -o yaml -n test
apiVersion: v1
kind: Pod
metadata:
? creationTimestamp: 2018-09-19T08:12:24Z
? generateName: t1-6b8bc99585-
? labels:
? ? app: t1
? ? name: t1
? ? pod-template-hash: "2646755141"
? name: t1-6b8bc99585-z2ft9
? namespace: test
? ownerReferences:
? - apiVersion: extensions/v1beta1
? ? blockOwnerDeletion: true
? ? controller: true
? ? kind: ReplicaSet
? ? name: t1-6b8bc99585
? ? uid: bd100daa-bbe3-11e8-a6ee-000c29bd652e
? resourceVersion: "446151"
? selfLink: /api/v1/namespaces/test/pods/t1-6b8bc99585-z2ft9
? uid: bd44312f-bbe3-11e8-a6ee-000c29bd652e
spec:
? containers:
? - image: httpd
? ? imagePullPolicy: Always
? ? name: t1
? ? resources: {}
? ? terminationMessagePath: /dev/termination-log
? ? terminationMessagePolicy: File
? ? volumeMounts:
? ? - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
? ? ? name: test-token-sqscc
? ? ? readOnly: true
? dnsPolicy: ClusterFirst
? nodeName: k8s-master1
? restartPolicy: Always
? schedulerName: default-scheduler
? securityContext: {}
? serviceAccount: test
? serviceAccountName: test
? terminationGracePeriodSeconds: 30
? tolerations:
? - effect: NoExecute
? ? key: node.kubernetes.io/not-ready
? ? operator: Exists
? ? tolerationSeconds: 300
? - effect: NoExecute
? ? key: node.kubernetes.io/unreachable
? ? operator: Exists
? ? tolerationSeconds: 300
? volumes:
? - name: test-token-sqscc
? ? secret:
? ? ? defaultMode: 420
? ? ? secretName: test-token-sqscc
status:
? conditions:
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-19T08:12:24Z
? ? status: "True"
? ? type: Initialized
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-19T08:12:32Z
? ? status: "True"
? ? type: Ready
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-19T08:12:24Z
? ? status: "True"
? ? type: PodScheduled
? containerStatuses:
? - containerID: docker://8725d70ccaf3374f54186d122e7ef479cada1f3aca5b416648e7f7d6a3067912
? ? image: httpd:latest
? ? imageID: docker-pullable://httpd@sha256:1ff11a7a625361f809065e5a421b69ce74e930a34f588320b957ca12a439e1c1
? ? lastState: {}
? ? name: t1
? ? ready: true
? ? restartCount: 0
? ? state:
? ? ? running:
? ? ? ? startedAt: 2018-09-19T08:12:31Z
? hostIP: 192.168.211.128
? phase: Running
? podIP: 172.30.2.5
? qosClass: BestEffort
? startTime: 2018-09-19T08:12:24Z
[root@k8s-master2 ~]#

k8s rbac手動創建sa並在pod使用